CVE-2026-62139: WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability

Q: What must an attacker do to exploit this issue?

An attacker needs to cause a victim to interact with a crafted request, as indicated by the required user interaction in the CVSS vector. The attack can be delivered over the network and does not require the attacker to authenticate.

Q: What is the likely impact if exploitation succeeds?

The reported impact is limited to integrity, with no reported confidentiality or availability impact. The CVSS vector rates integrity impact as low.

Q: Which installations should be investigated?

Investigate sites using the Google Site Kit by Google WordPress plugin at version 1.186.0 or earlier. The provided data does not identify a configuration-based exception.

Published Sep 11, 2026

Updated

Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

Affected Software

1 affected component

Google Site Kit by Google<=1.186.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Site Kit by Google plugin to a version that resolves this vulnerability.
Fixed in 1.187.0

Event History

Sep 11, 2026

CVE Published

via MITRE·06:12 PM

Data Sourced

via MITRE·06:12 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker needs to cause a victim to interact with a crafted request, as indicated by the required user interaction in the CVSS vector. The attack can be delivered over the network and does not require the attacker to authenticate.

What is the likely impact if exploitation succeeds?